Scammers posing as HR staff at major brands are luring targets into an interview “scheduling” flow that ultimately steals corporate passwords on mobile devices. The campaign uses a browser-in-the-browser style approach (or a full-screen fake login on phones) and even blocks personal email logins to focus only on high-value corporate accounts.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a text or email from “HR” at a big-name company: “Interview scheduling request, please sign in to confirm your availability.” You tap the link on your phone and it opens a full-screen login. No browser frame, no address bar, just a page asking for your corporate email and password on something like “acme-careers.com.” This is a mobile browser-in-the-browser style scam built to steal corporate logins. Here’s the sneaky part: type a personal Gmail or Outlook address and the site rejects it. Only your corporate account is allowed through. Zimperium found these fake HR sites running for months on common hosts like AWS, using lookalike domains like “-careers” and “-global” to reel people in. If any interview link on your phone opens a full-screen login and refuses personal email, stop. Don’t sign in there, contact the recruiter or company using a known email or phone number and confirm it first.
A real “fake recruiter” phishing campaign (tracked as RecruitTrap) is targeting employees’ corporate credentials, especially on mobile devices. The scam uses lookalike recruitment domains and full-screen fake login pages that hide browser cues, and it rejects personal email addresses to focus on…
Check Point reports that scammers are now impersonating ChatGPT/OpenAI in phishing campaigns, reflecting how mainstream the service has become. One documented example used a fake “ChatGPT Plus payment failure” notice that sent victims to a fraudulent payment page designed to capture full credit…
Check Point reports that OpenAI’s ChatGPT became a top-10 most impersonated brand in Q2 2026 phishing. One observed example used a fake “ChatGPT Plus payment failed” billing email to drive victims to a credit-card theft page. The report also notes other brand-impersonation scams using cloned stores…
Microsoft reports disrupting a Chinese-language “phishing-as-a-service” ecosystem that sold phishing kits and “legitimate-looking” cloud infrastructure to criminals worldwide. The operation enabled large-scale email and SMS phishing that impersonated trusted brands (government, delivery,…
Researchers demonstrated how attackers can register lookalike web domains using two specific Unicode characters that Chromium-based browsers may display as trustworthy, normal-looking URLs. This can make phishing and typosquatting sites appear legitimate to employees, increasing the chance they…
Researchers uncovered a human-run phishing platform that pretends to be ad-management products for popular AI brands (ChatGPT, Gemini, Claude, and others). Victims are pushed to click a “Connect” flow that opens a convincing fake login window (showing trusted domains like accounts.google.com) to…
